NSE5_SSE_AD-26 Practice Tests - FortiSASE and SD-WAN 26 Core Administrator

Prévia do material em texto

1 / 8
Exam : NSE5_SSE_AD-26
Title :
https://www.passcert.com/NSE5_SSE_AD-26.html
Fortinet NSE 5 - FortiSASE
and SD-WAN 26 Core
Administrator
2 / 8
1.A FortiGate running FortiOS 7.6.3 must apply a different firewall policy to wan2, which is already an
SD-WAN member. Other members must keep their current policy treatment.
Which design meets this requirement?
A. Reference wan2 directly as the outgoing firewall-policy interface.
B. Place wan2 in its own SD-WAN zone and reference that zone in the policy.
C. Keep all members in one zone and use the member sequence number as the policy interface.
D. Create a performance SLA named wan2 and use it as the outgoing policy interface.
Answer: B
Explanation:
B is correct: a zone may contain one member, allowing a separate policy to select that member through
its zone.
2.During a basic FortiOS 7.6.3 SD-WAN deployment, an existing firewall policy references wan1 directly.
The administrator wants to add wan1 as an SD-WAN member.
Which preparation is required?
A. Change the implicit-rule load-balancing algorithm.
B. Increase the member cost before adding the interface.
C. Remove the conflicting direct references to wan1 before adding it.
D. Create an SLA target with a zero latency threshold.
Answer: C
Explanation:
C is correct: selected interfaces must be removed from other conflicting configurations before becoming
SD-WAN members.
3.A branch uses an ISP broadband circuit to carry a site-to-site IPsec tunnel to its data center.
Which two statements correctly identify these components? (Choose two)
A. The broadband circuit is an underlay transport.
B. The IPsec tunnel is the underlay because it carries private application traffic.
C. The ISP circuit is an overlay because it can carry encrypted packets.
D. The IPsec tunnel is an overlay built over the transport network.
Answer: A, D
Explanation:
A is correct: the broadband circuit provides the underlying WAN transport.
D is correct: site-to-site IPsec is a typical VPN overlay constructed over underlay connectivity.
4.A branch sends internet-bound traffic through an IPsec overlay to a hub, where it exits through the hub
WAN interface.
Which description fits this path?
A. Direct internet access through the branch local ISP.
B. Passive measurement of the branch local WAN.
C. Remote internet access through the hub.
D. A local-out connection originated by the branch FortiGate.
Answer: C
Explanation:
3 / 8
C is correct: the branch uses the overlay and the hub WAN for remote internet access.
5.On the FortiOS 7.6.3 Performance SLAs page, a participant shows a green up arrow. A colleague
concludes that the participant meets every configured SLA target.
Which response is correct?
A. The arrow confirms that the server responds; target compliance must be checked separately.
B. The arrow confirms that latency, jitter and packet loss are all below their target thresholds.
C. The arrow confirms that the implicit SD-WAN rule selected this member for every session.
D. The arrow confirms that all other participants failed their health checks.
Answer: A
Explanation:
A is correct: the up arrow indicates a responding server, not that all SLA constraints are satisfied.
6.Match each required measurement behavior to its probe mode. Use each numbered mode once.
Record all three mappings.
Modes:
1) Active;
2) Passive;
3) Prefer passive.
Answer: A-2, B-1, C-3
Explanation:
A-2 is correct: passive measurement uses session information captured by suitably configured firewall
policies.
B-1 is correct: active measurement sends protocol-specific probes to a configured server.
C-3 is correct: prefer passive combines traffic-based measurement with probing when traffic is absent.
7.A FortiOS 7.6.3 SD-WAN participant repeatedly changes state because of brief bursts of lost probes.
The administrator wants several failed checks before declaring it inactive and several successful checks
before restoring it.
Which two settings directly implement these requirements? (Choose two)
A. Interface member cost.
B. Failures before inactive.
C. Restore link after.
D. Implicit-rule source-IP hash.
Answer: B, C
Explanation:
B is correct: it requires the configured number of failed status checks before inactivity.
4 / 8
C is correct: it requires successful checks before restoring the active state.
8.A FortiOS 7.6.3 rule uses Lowest Cost (SLA), with load balancing disabled. All listed members are
alive and have valid routes. minimum-sla-meet-members is set to 1.
Which member is selected?
A. wan1, because cost zero overrides SLA qualification.
B. wan3, because higher cost represents better quality.
C. All three members, because all are alive.
D. wan2, because it has the lowest cost among qualifying members.
Answer: D
Explanation:
D is correct: wan2 and wan3 qualify, and wan2 has the lower cost.
9.A FortiOS 7.6.3 rule uses Best Quality with latency as link-cost-factor and link-cost-threshold set to 0.
Both members are eligible and alive; there is no additional tie.
Which member is preferred?
A. wan1, because its jitter is lower.
B. wan2, because latency is the selected comparison metric.
C. Both members, because Best Quality always balances equally.
D. Neither member, because no member cost was provided.
Answer: B
Explanation:
B is correct: wan2 has lower latency, and the question removes the preferred-member quality advantage
by setting the threshold to zero.
10.A FortiOS 7.6.3 manual SD-WAN rule has priority-members 2 1 and load balancing disabled.
Members 1 and 2 are both available and have valid routes. Member 1 has lower latency.
Which member is preferred by this rule?
A. Member 2, because it is first in the configured preference order.
B. Member 1, because manual mode always chooses lower latency.
C. Both members, because specifying two members automatically enables load balancing.
5 / 8
D. Neither member, because manual mode requires an SLA target.
Answer: A
Explanation:
A is correct: a manual rule uses the configured interface order when load balancing is disabled.
11.A new session does not match any explicit SD-WAN rule. Eligible SD-WAN routes and a permitting
firewall policy exist.
Which SD-WAN mechanism handles traffic distribution?
A. The first explicit rule, regardless of its criteria.
B. The last explicit rule, regardless of its criteria.
C. The implicit SD-WAN rule and its configured balancing algorithm.
D. A deny action inherent in every unmatched SD-WAN service.
Answer: C
Explanation:
C is correct: the implicit rule is used when no explicit SD-WAN rule matches.
12.In a documented FortiGate troubleshooting case, a health check and locally originated BGP packets
use the same source and destination. The business routing table switches to a backup tunnel, but a
packet capture still shows BGP sent to the failed primary tunnel.
Which investigation is most directly supported by this condition?
A. Change the firewall policy ID, because policy ID determines the health-check source.
B. Inspect the kernel route created for the health check and check whether BGP matches its source and
destination.
C. Conclude that every FortiOS route type prefers the failed tunnel.
D. Delete the backup static route because a successful health check must remove its own probe route.
Answer: B
Explanation:
B is correct: the official case shows a retained health-check kernel route matching the BGP source and
destination, explaining the observed path.
13.On FortiOS 7.6.3, an established session uses SNAT. A routing change makes another interface
preferable, but the session's previous route remains active. snat-route-change is disabled and no other
session-reset trigger occurs.
What is the documented default behavior?
A. The session immediately changes interfaces and must receive a new SNAT mapping.
B. The session becomes a new session solely because the preferred route changed.
C. The session is dropped solely because its old route is no longer the most preferred.
D. The session keeps the same outbound interface while its old route remains active.
Answer:D
Explanation:
D is correct: the documented SNAT default preserves the outbound interface while the old route remains
active.
14.An organization cannot install FortiClient on a set of browser-based devices. It wants their proxy-
6 / 8
aware web traffic inspected by FortiSASE.
Which approach fits this requirement?
A. Configure FortiSASE SWG agentless proxy settings for the browser or supported OS.
B. Register an invitation code and assume that this installs a full network tunnel in the browser.
C. Deploy a FortiGate SD-WAN template directly into each browser.
D. Use only endpoint telemetry registration without a proxy or tunnel configuration.
Answer: A
Explanation:
A is correct: agentless SWG uses explicit web-proxy configuration and does not require FortiClient.
15.FortiSASE uses SAML SSO with Microsoft Entra ID to authenticate remote users.
Which two role assignments are correct? (Choose two)
A. FortiSASE acts as the identity provider.
B. Microsoft Entra ID acts as the identity provider.
C. FortiSASE acts as the service provider.
D. FortiClient becomes the identity provider because it initiates the connection.
Answer: B, C
Explanation:
B is correct: Entra ID authenticates the user and supplies the assertion as IdP.
C is correct: FortiSASE consumes the assertion as SP.
16.An administrator creates a FortiSASE user group for identities from a configured remote
authentication server. The group must match a named group from that server.
Which configuration provides this association?
A. Select the endpoint profile Default and treat its name as the remote group.
B. Enter the remote group name as an SD-WAN zone.
C. Set a report email group with the same display name.
D. Add a Remote Groups entry selecting the remote server and the required group identifier.
Answer: D
Explanation:
D is correct: Remote Groups associates the selected remote server with the group identifiers to match.
17.A user followed an Onboard Users email and successfully registered FortiClient with the FortiSASE
Endpoint Management Service. No access-user provisioning has been completed.
What can the administrator conclude?
A. Registration proves that the user can access every tunnel and private resource.
B. Management registration succeeded, but access-user provisioning is still required for tunnels and
other resources.
C. The registration code is necessarily the user SAML password.
D. Registration proves that a group-specific firewall policy has already matched.
Answer: B
Explanation:
B is correct: the documentation explicitly requires provisioning users for tunnel and resource access
even after registration.
7 / 8
18.A FortiSASE SAML user authenticates successfully, but a policy restricted to a particular remote
group records no hits. A general policy for authenticated users does record hits.
Which two checks directly address the missing group-specific match? (Choose two)
A. Verify that the assertion includes the expected group attribute and value.
B. Assume that successful authentication proves that every remote group is mapped correctly.
C. Compare the asserted group identifier with the configured Remote Groups mapping, including case
where applicable.
D. Change an unrelated report output format from PDF to CSV.
Answer: A, C
Explanation:
A is correct: user authentication can succeed while the group information needed for authorization is
absent or different.
C is correct: the group value and configured mapping must agree; the historical FAC case explicitly
illustrates case-sensitive mismatch.
19.Match each business requirement to the FortiSASE access purpose. Use each numbered purpose
once.
Purposes:
1) Secure SaaS access (SSA);
2) Secure internet access (SIA);
3) Secure private access (SPA).
Answer: A-2, B-3, C-1
Explanation:
A-2 is correct: SIA extends internet security enforcement to remote users.
B-3 is correct: SPA provides access to privately hosted company applications.
C-1 is correct: SSA addresses SaaS application access and associated security controls.
20.In the documented FortiSASE secure private access design that integrates with an existing FortiGate
SD-WAN hub network, which two statements describe the security PoPs? (Choose two)
A. They replace the hub by acting as unmanaged Ethernet switches.
B. They act as spokes in the SD-WAN network.
C. They use only a browser PAC file to exchange private-network routes with the hub.
D. They use IPsec overlays and BGP to secure and route connectivity to the organization network.
Answer: B, D
Explanation:
B is correct: security PoPs participate as spokes.
8 / 8
D is correct: the documented integration relies on IPsec overlays and BGP.
21.A FortiSASE policy must inspect the contents of HTTPS file uploads with DLP. Traffic is not exempt
from inspection.
Which two conditions support this requirement? (Choose two)
A. Use certificate inspection alone to expose the encrypted file contents.
B. Use SSL deep inspection on the matching traffic.
C. Leave the replacement signing CA untrusted on the client to improve inspection coverage.
D. Ensure the client trusts the CA used to sign FortiSASE replacement certificates.
Answer: B, D
Explanation:
B is correct: deep inspection exposes encrypted content to the relevant inspection engines.
D is correct: the endpoint must trust the signing CA for the intercepted TLS connection.
22.A FortiSASE design needs to insert HTTP headers that restrict SaaS access to approved tenants.
Which feature implements this mechanism?
A. Web Filter with Inline-CASB.
B. Application Control category Monitor without header configuration.
C. Endpoint vulnerability scanning.
D. An SD-WAN member cost setting.
Answer: A
Explanation:
A is correct: the documented Web Filter Inline-CASB mechanism inspects and modifies HTTP headers to
restrict tenant access.